Top 10 Attacked user by Phish messages

Description

Top 10 attacked users by Phish messages from external senders using Teams

Query · kql

//Top 10 attacked users by Phish messages from external senders using Teams. Replace contoso.com with your own recipient domain.
MessageEvents
| where ThreatTypes has 'Phish' and IsOwnedThread==0 and IsExternalThread==1
| mv-expand Recipients = RecipientDetails
| extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType
| where RecipientEmailAddress contains ('contoso.com')
| summarize count() by tostring(RecipientEmailAddress)
| sort by count_
| top 10 by count_
Raw source Top 10 Attacked user by Phish messages · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: e6cbca08-b041-4f5d-9f82-f803319ee050
name: Top 10 Attacked user by Phish messages
description: |
  Top 10 attacked users by Phish messages from external senders using Teams
description-detailed: |
  Top 10 attacked users by Phish messages from external senders using Teams. Replace contoso.com with your own recipient domain.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - MessageEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  //Top 10 attacked users by Phish messages from external senders using Teams. Replace contoso.com with your own recipient domain.
  MessageEvents
  | where ThreatTypes has 'Phish' and IsOwnedThread==0 and IsExternalThread==1
  | mv-expand Recipients = RecipientDetails
  | extend RecipientEmailAddress = Recipients.RecipientSmtpAddress, RecipientDisplayName = Recipients.RecipientDisplayName, RecipientObjectId = Recipients.RecipientObjectId, RecipientType = Recipients.RecipientType
  | where RecipientEmailAddress contains ('contoso.com')
  | summarize count() by tostring(RecipientEmailAddress)
  | sort by count_
  | top 10 by count_
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.